darkcomet | f8382a87bb775e3292a331c9f8593f74f1ce79c779c6b9fc3b5880119e166f5c

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2025, 19:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_9457b2cd1a08799db8940186c5f31f53.exe
Size

912KB
MD5

9457b2cd1a08799db8940186c5f31f53
SHA1

26c340f41fbac82e85a700a2fd02a66ad7118f24
SHA256

f8382a87bb775e3292a331c9f8593f74f1ce79c779c6b9fc3b5880119e166f5c
SHA512

b05f863884afca7940a163ce7658090e2cf10e906c2da1bb0ee262fb165086ac17c5429a2bf7bbd662f0693238e90f72af1edd7aaf46174184d8ca6c813a93ef
SSDEEP

12288:Bsm6a+fi4vNVDEumHy9obTWAoCQNbo75lYzZ+IrlV/3oWoYAWgyMHC0L:Th+BvXuTbTWJNM7jYznj/PotAMi0L

Score

10^/10

darkcomet mr.root defense_evasion discovery persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Mr.root

linuxer.no-ip.org:8080

linuxer.no-ip.org:80

Mutex

DC_MUTEX-5YS10D7

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
13Q0YE0nY4ol
install
true
offline_keylogger
true
password
study!@#
persistence
false
reg_key
MicroUpdate

rc4.plain

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	dddd.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4356	attrib.exe
4724	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	JaffaCakes118_9457b2cd1a08799db8940186c5f31f53.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	dddd.exe

Executes dropped EXE 5 IoCs

pid	Process
5312	IDM.v6.xx.release.3-patch.exe
5984	dddd.exe
5332	dddd.exe
5900	msdcsc.exe
5020	msdcsc.exe

Loads dropped DLL 1 IoCs

pid	Process
5312	IDM.v6.xx.release.3-patch.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	dddd.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	dddd.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	dddd.exe
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	dddd.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5984 set thread context of 5332	5984	dddd.exe	88
PID 5900 set thread context of 5020	5900	msdcsc.exe	100

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5332-28-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/5332-30-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/5332-31-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/5332-32-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/5332-26-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/5020-97-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/5020-99-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/5020-100-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/5332-101-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/5020-107-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/5020-108-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/5020-111-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/5020-114-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/5020-117-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/5020-120-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/5020-123-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/5020-126-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/5020-129-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/5020-132-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/5020-135-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/5020-138-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/5020-141-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/5020-144-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/5020-147-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdcsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IDM.v6.xx.release.3-patch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_9457b2cd1a08799db8940186c5f31f53.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	dddd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5020	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: 33	4000	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4000	AUDIODG.EXE
Token: SeIncreaseQuotaPrivilege	5332	dddd.exe
Token: SeSecurityPrivilege	5332	dddd.exe
Token: SeTakeOwnershipPrivilege	5332	dddd.exe
Token: SeLoadDriverPrivilege	5332	dddd.exe
Token: SeSystemProfilePrivilege	5332	dddd.exe
Token: SeSystemtimePrivilege	5332	dddd.exe
Token: SeProfSingleProcessPrivilege	5332	dddd.exe
Token: SeIncBasePriorityPrivilege	5332	dddd.exe
Token: SeCreatePagefilePrivilege	5332	dddd.exe
Token: SeBackupPrivilege	5332	dddd.exe
Token: SeRestorePrivilege	5332	dddd.exe
Token: SeShutdownPrivilege	5332	dddd.exe
Token: SeDebugPrivilege	5332	dddd.exe
Token: SeSystemEnvironmentPrivilege	5332	dddd.exe
Token: SeChangeNotifyPrivilege	5332	dddd.exe
Token: SeRemoteShutdownPrivilege	5332	dddd.exe
Token: SeUndockPrivilege	5332	dddd.exe
Token: SeManageVolumePrivilege	5332	dddd.exe
Token: SeImpersonatePrivilege	5332	dddd.exe
Token: SeCreateGlobalPrivilege	5332	dddd.exe
Token: 33	5332	dddd.exe
Token: 34	5332	dddd.exe
Token: 35	5332	dddd.exe
Token: 36	5332	dddd.exe
Token: SeIncreaseQuotaPrivilege	5020	msdcsc.exe
Token: SeSecurityPrivilege	5020	msdcsc.exe
Token: SeTakeOwnershipPrivilege	5020	msdcsc.exe
Token: SeLoadDriverPrivilege	5020	msdcsc.exe
Token: SeSystemProfilePrivilege	5020	msdcsc.exe
Token: SeSystemtimePrivilege	5020	msdcsc.exe
Token: SeProfSingleProcessPrivilege	5020	msdcsc.exe
Token: SeIncBasePriorityPrivilege	5020	msdcsc.exe
Token: SeCreatePagefilePrivilege	5020	msdcsc.exe
Token: SeBackupPrivilege	5020	msdcsc.exe
Token: SeRestorePrivilege	5020	msdcsc.exe
Token: SeShutdownPrivilege	5020	msdcsc.exe
Token: SeDebugPrivilege	5020	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	5020	msdcsc.exe
Token: SeChangeNotifyPrivilege	5020	msdcsc.exe
Token: SeRemoteShutdownPrivilege	5020	msdcsc.exe
Token: SeUndockPrivilege	5020	msdcsc.exe
Token: SeManageVolumePrivilege	5020	msdcsc.exe
Token: SeImpersonatePrivilege	5020	msdcsc.exe
Token: SeCreateGlobalPrivilege	5020	msdcsc.exe
Token: 33	5020	msdcsc.exe
Token: 34	5020	msdcsc.exe
Token: 35	5020	msdcsc.exe
Token: 36	5020	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5020	msdcsc.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 5136 wrote to memory of 5312	5136	JaffaCakes118_9457b2cd1a08799db8940186c5f31f53.exe	85
PID 5136 wrote to memory of 5312	5136	JaffaCakes118_9457b2cd1a08799db8940186c5f31f53.exe	85
PID 5136 wrote to memory of 5312	5136	JaffaCakes118_9457b2cd1a08799db8940186c5f31f53.exe	85
PID 5136 wrote to memory of 5984	5136	JaffaCakes118_9457b2cd1a08799db8940186c5f31f53.exe	86
PID 5136 wrote to memory of 5984	5136	JaffaCakes118_9457b2cd1a08799db8940186c5f31f53.exe	86
PID 5136 wrote to memory of 5984	5136	JaffaCakes118_9457b2cd1a08799db8940186c5f31f53.exe	86
PID 5984 wrote to memory of 5332	5984	dddd.exe	88
PID 5984 wrote to memory of 5332	5984	dddd.exe	88
PID 5984 wrote to memory of 5332	5984	dddd.exe	88
PID 5984 wrote to memory of 5332	5984	dddd.exe	88
PID 5984 wrote to memory of 5332	5984	dddd.exe	88
PID 5984 wrote to memory of 5332	5984	dddd.exe	88
PID 5984 wrote to memory of 5332	5984	dddd.exe	88
PID 5332 wrote to memory of 1932	5332	dddd.exe	91
PID 5332 wrote to memory of 1932	5332	dddd.exe	91
PID 5332 wrote to memory of 1932	5332	dddd.exe	91
PID 5332 wrote to memory of 2236	5332	dddd.exe	93
PID 5332 wrote to memory of 2236	5332	dddd.exe	93
PID 5332 wrote to memory of 2236	5332	dddd.exe	93
PID 2236 wrote to memory of 4356	2236	cmd.exe	95
PID 2236 wrote to memory of 4356	2236	cmd.exe	95
PID 2236 wrote to memory of 4356	2236	cmd.exe	95
PID 1932 wrote to memory of 4724	1932	cmd.exe	96
PID 1932 wrote to memory of 4724	1932	cmd.exe	96
PID 1932 wrote to memory of 4724	1932	cmd.exe	96
PID 5332 wrote to memory of 5900	5332	dddd.exe	97
PID 5332 wrote to memory of 5900	5332	dddd.exe	97
PID 5332 wrote to memory of 5900	5332	dddd.exe	97
PID 5900 wrote to memory of 5020	5900	msdcsc.exe	100
PID 5900 wrote to memory of 5020	5900	msdcsc.exe	100
PID 5900 wrote to memory of 5020	5900	msdcsc.exe	100
PID 5900 wrote to memory of 5020	5900	msdcsc.exe	100
PID 5900 wrote to memory of 5020	5900	msdcsc.exe	100
PID 5900 wrote to memory of 5020	5900	msdcsc.exe	100
PID 5900 wrote to memory of 5020	5900	msdcsc.exe	100
PID 5020 wrote to memory of 5572	5020	msdcsc.exe	101
PID 5020 wrote to memory of 5572	5020	msdcsc.exe	101
PID 5020 wrote to memory of 5572	5020	msdcsc.exe	101
PID 5020 wrote to memory of 5572	5020	msdcsc.exe	101
PID 5020 wrote to memory of 5572	5020	msdcsc.exe	101
PID 5020 wrote to memory of 5572	5020	msdcsc.exe	101
PID 5020 wrote to memory of 5572	5020	msdcsc.exe	101
PID 5020 wrote to memory of 5572	5020	msdcsc.exe	101
PID 5020 wrote to memory of 5572	5020	msdcsc.exe	101
PID 5020 wrote to memory of 5572	5020	msdcsc.exe	101
PID 5020 wrote to memory of 5572	5020	msdcsc.exe	101
PID 5020 wrote to memory of 5572	5020	msdcsc.exe	101
PID 5020 wrote to memory of 5572	5020	msdcsc.exe	101
PID 5020 wrote to memory of 5572	5020	msdcsc.exe	101
PID 5020 wrote to memory of 5572	5020	msdcsc.exe	101
PID 5020 wrote to memory of 5572	5020	msdcsc.exe	101
PID 5020 wrote to memory of 5572	5020	msdcsc.exe	101
PID 5020 wrote to memory of 5572	5020	msdcsc.exe	101
PID 5020 wrote to memory of 5572	5020	msdcsc.exe	101
PID 5020 wrote to memory of 5572	5020	msdcsc.exe	101
PID 5020 wrote to memory of 5572	5020	msdcsc.exe	101
PID 5020 wrote to memory of 5572	5020	msdcsc.exe	101

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4356	attrib.exe
4724	attrib.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9457b2cd1a08799db8940186c5f31f53.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9457b2cd1a08799db8940186c5f31f53.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5136
- C:\Users\Admin\AppData\Local\Temp\IDM.v6.xx.release.3-patch.exe
  "C:\Users\Admin\AppData\Local\Temp\IDM.v6.xx.release.3-patch.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5312
- C:\Users\Admin\AppData\Local\Temp\dddd.exe
  "C:\Users\Admin\AppData\Local\Temp\dddd.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5984
- - C:\Users\Admin\AppData\Local\Temp\dddd.exe
    C:\Users\Admin\AppData\Local\Temp\dddd.exe
    3⤵
    - Modifies WinLogon for persistence
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5332
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\dddd.exe" +s +h
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1932
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Users\Admin\AppData\Local\Temp\dddd.exe" +s +h
        5⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:4724
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2236
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
        5⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:4356
  - - C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
      "C:\Windows\system32\MSDCSC\msdcsc.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5900
    - - C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
        
        C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5020
      - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5572

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x500 0x4b0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\MSDCSC\msdcsc.exe
1⤵
PID:4088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IDM.v6.xx.release.3-patch.exe

Filesize
622KB

MD5
02106a846c69468db29f2137203857e0

SHA1
b028922f390c56f5848be3ff3d3507f5c07f87b5

SHA256
e1ff2ecf46db4b9fde9b061cdd0c055dbca2755dc0500bf6c7d1a3284cb46d35

SHA512
5595b966db8ecc354c0be847ce46430baf8f124e1048b2506293d30ab5201828a2c9ab93be8888d13113fff60ef830d68914762f8ab24d64cd17043ba9be18f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\bassmod.dll

Filesize
33KB

MD5
e4ec57e8508c5c4040383ebe6d367928

SHA1
b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06

SHA256
8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f

SHA512
77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822

Download Submit
C:\Users\Admin\AppData\Local\Temp\dddd.exe

Filesize
284KB

MD5
2c00fe9368bbed106937fc627dbe5dd2

SHA1
d38394ed6228d02a12a4789a698b2011b8218ff6

SHA256
5c6dba7fdef39e82756a2aafa05a6587892b85c32cd00c0d78e8a626d04fcf68

SHA512
b67e59e1eee862c1d052a07bb0c032ab389426bac37dd4b4ad1ceb74e560fd7309847a4dba75bcff2e4fe680071d910bc5db6143b6bd89a4fae24a967eae77b9

Download Submit
memory/5020-126-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/5020-99-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/5020-141-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/5020-138-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/5020-135-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/5020-132-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/5020-129-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/5020-108-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/5020-97-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/5020-144-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/5020-100-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/5020-123-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/5020-120-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/5020-117-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/5020-114-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/5020-147-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/5020-111-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/5020-107-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/5312-113-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/5312-128-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/5312-105-0x0000000000400000-0x0000000000573000-memory.dmp

Filesize
1.4MB

Download
memory/5312-106-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/5312-104-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/5312-116-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/5312-103-0x00000000001E0000-0x00000000001E3000-memory.dmp

Filesize
12KB

Download
memory/5312-119-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/5312-12-0x00000000001E0000-0x00000000001E3000-memory.dmp

Filesize
12KB

Download
memory/5312-122-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/5312-146-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/5312-125-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/5312-11-0x0000000000400000-0x0000000000573000-memory.dmp

Filesize
1.4MB

Download
memory/5312-110-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/5312-143-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/5312-131-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/5312-25-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/5312-134-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/5312-140-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/5312-137-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/5332-28-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/5332-30-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/5332-31-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/5332-32-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/5332-26-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/5332-101-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/5572-98-0x0000000000430000-0x0000000000431000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads